Last updated: August 19, 2026
JobSignal is operated by [Legal entity name], a company registered in [country of incorporation] ("JobSignal," "we," "us"). This policy covers two groups of people whose personal data we process: candidates (people whose CVs, applications, and interview information pass through the platform) and organization users (recruiters, hiring managers, and admins at companies that use JobSignal). It applies wherever JobSignal processes personal data as part of providing the service.
Primarily to provide the recruiting service the organization has signed up for: matching and scoring candidates against roles, scheduling interviews (including creating calendar and video-meeting invitations with the providers listed in §7), sending transactional email, and giving recruiters tools to manage a hiring pipeline. Technical/log data is processed to secure and operate the platform and to investigate misuse.
Aggregated and anonymized data, statistics that no longer identify any individual candidate or organization (for example, platform-wide counts and trends), may also be used for product improvement, benchmarking, and business reporting, including with prospective investors or partners. Data is anonymized before it is used this way; this policy does not authorize sharing or selling data that could identify a candidate or company.
For candidate data, the organization using JobSignal is generally the data controller and is responsible for having a lawful basis before processing a candidate's information. Where a recruiter imports CVs in bulk (rather than a candidate applying directly), the product requires them to affirmatively select the basis they're relying on (candidate consent, legitimate interest, or an existing relationship with the candidate) before the import proceeds, and to confirm they have that basis. JobSignal acts as a data processor on the organization's behalf for this processing.
For organization users' own account data, and for the aggregated/anonymized analytics use described in §3, JobSignal acts as the data controller, on the basis of performing our contract with the organization (account data) or our legitimate interest in understanding and improving the platform (anonymized analytics, which by definition no longer involves personal data once anonymized).
Each organization can configure a candidate data retention period in days; where set, candidate records are automatically subject to that schedule. Where no period is configured, candidate data is kept until the organization or the candidate requests its deletion. Account data for organization users is kept for the life of the account. Deletion, whether triggered by an organization's retention setting or by an individual rights request under §6, removes the candidate's record and associated resumes from the platform.
Subject to applicable law (including GDPR for individuals in the EU/EEA/UK, and equivalent regimes elsewhere), you may have the right to access, correct, delete, export, or restrict our processing of your data, and to object to certain processing. Candidates should generally start with the organization that submitted or holds their application, since they control most candidate data directly; JobSignal will also action requests sent to us directly. To exercise these rights, contact privacy@jobsignal.eu. We aim to respond within the timeline required by applicable law (30 days under GDPR, extendable once by a further two months for complex requests).
We use a limited set of sub-processors to run the service: email delivery (Zoho), video-meeting creation for scheduled interviews (Zoom), and, depending on the AI configuration an organization or JobSignal has selected, either a self-hosted AI model (no data leaves JobSignal's own infrastructure) or a third-party commercial AI provider for candidate-matching analysis. Core application data (candidate records, resumes, files) is stored on infrastructure operated by JobSignal. Where any sub-processor is located outside the region a customer's data originates from, transfers rely on that provider's own standard safeguards (e.g. EU Standard Contractual Clauses where applicable).
Secrets and credentials stored by the platform (for example, third-party API keys and OAuth tokens) are encrypted at rest. Access to candidate and organization data is scoped per-organization and audit-logged. No system is perfectly secure; we investigate and respond to any confirmed incident and will notify affected organizations and, where legally required, regulators and individuals, without undue delay.
We may update this policy as the product changes. Material changes will be reflected in the "last updated" date above; where required by law, we will provide additional notice.
Questions about this policy: privacy@jobsignal.eu.